NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksUpdated

Apple fixes CoreGraphics zero-day CVE-2026-86950 linked to targeted attacks

A CoreGraphics flaw could let a malicious file run code on affected iPhones, iPads and Macs. Targeted exploitation was reported. Fixes now include older devices: install the latest Apple software update offered for your device.

What to do

On iPhone or iPad, open Settings → General → Software Update and install the latest offered update; the fixes start at 18.7.11 or 26.7.1 for the affected branches. On a Mac, use System Settings → General → Software Update; the fixes start at Sequoia 15.8.1 or Tahoe 26.7.1.

Check your devices
  • iOS 18fixed in 18.7.11 and later
  • iOS 26fixed in 26.7.1 and later
  • iPadOS 18fixed in 18.7.11 and later
  • iPadOS 26fixed in 26.7.1 and later
  • macOS Sequoiafixed in 15.8.1 and later
  • macOS Tahoefixed in 26.7.1 and later

What’s happening

CVE-2026-86950 is a memory-writing flaw in CoreGraphics, Apple's graphics component, that can let a malicious file run an attacker's code when processed. Apple disclosed it on 28 September, credited Meta Product Security and said it may have been used in sophisticated attacks against specific individuals on iOS versions before iOS 27. Initial fixes covered iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. CISA listed it as exploited on 29 September. By 27 October, Apple had extended protection to older iPhones and iPads through the 18.7.11 branch. Fixes are now available for all affected supported branches in Apple's CVE product data. Canada's alert also lists several version-27 operating systems, watchOS and visionOS; Apple's CVE product data does not list those as affected. The reviewed sources do not disclose victim numbers, attacker identities or whether victims were notified.

What
Flaw
Affects
Apple iPhone, iPad and Mac
Affected
iOS and iPadOS 18 before 18.7.11
iOS and iPadOS 26 before 26.7.1
macOS Sequoia before 15.8.1
macOS Tahoe before 26.7.1
Fixed in
iOS and iPadOS 18.7.11
iOS and iPadOS 26.7.1
macOS Sequoia 15.8.1
macOS Tahoe 26.7.1
CVE
CVE-2026-86950
Since
28 Sept 2026

Timeline

  1. New fixFixed

    BleepingComputer reported that Apple had extended the fix to older iPhones and iPads, including the iPhone XS, XS Max and XR. Apple's affected-product data lists 18.7.11 as the fixed version for the older iOS and iPadOS branch.

  2. Update

    NHS England warned that the flaw was being exploited and urged updates to iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.

  3. CISA added

    The Canadian Centre for Cyber Security reported that CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities catalogue that day.

  4. New fix

    Apple also released macOS Sequoia 15.8.1, fixing the same CoreGraphics flaw on that Mac operating system.

  5. Made publicPartly fixed

    Apple released iOS and iPadOS 26.7.1 for CVE-2026-86950. It said processing a malicious file could run code and that the flaw may have been used against specific individuals running iOS versions before iOS 27.

Sources

  1. About the security content of iOS 26.7.1 and iPadOS 26.7.1Apple · 28 Sept 2026
  2. About the security content of macOS Sequoia 15.8.1Apple · 28 Sept 2026
  3. CVE-2026-86950 Detail — includes Apple's affected-product dataNIST · 27 Oct 2026
  4. Apple security advisory (AV26-971)Canadian Centre for Cyber Security · 29 Sept 2026
  5. Apple Releases Security Updates for macOS, iOS, and iPadOSNHS England · 30 Sept 2026
  6. Apple backports CoreGraphics zero-day patches to older iPhonesBleepingComputer · 27 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from September 2026 · JSON · RSS